Just a note for anyone finding this - I have found a bug that occurs in Tailscale on FreeBSD/OPNsense. There seems to be a race condition that causes tailscale to sometimes not build its node entry in tailscale on a service restart; this will be detectable because any client trying to use the FreeBSD/OPNsense node as an exit node will not have functional DNS setup. I have reported this to the tailscale project and posted my current workaround here: https://github.com/tailscale/tailscale/issues/16693